NetBIOS Enumeration on Port 139 for CEH

Enumeration

As a certified ethical hacker, you are tasked with gaining information about an enterprise's internal network. You are permitted to test the network's security using enumeration techniques. You successfully obtain a list of usernames using email IDs and execute a DNS Zone Transfer. Which enumeration technique would be most effective for your next move given that you have identified open TCP ports 25 (SMTP) and 139 (NetBIOS Session Service)?

Perform a brute force attack on Microsoft Active Directory to extract valid usernames
Exploit the NetBIOS Session Service on TCP port 139 to gain unauthorized access to the file system Correct Answer
Use SNMP to extract usernames given the community strings
Exploit the NFS protocol on TCP port 2049 to gain control over a remote system

Answer Correct answer: B — Exploit the NetBIOS Session Service on TCP port 139 to gain unauthorized access to the file system

Community Votes

59%

41%

59% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests the prioritization of enumeration steps based on identified services, with a common trap being the confusion between exploitation and data extraction.

This question evaluates the correct enumeration technique following the discovery of open TCP ports 25 and 139. The correct answer leverages NetBIOS Session Service to extract sensitive network information.

Many candidates choose Option A (Brute force Active Directory) because they overlook that valid usernames were already obtained via DNS Zone Transfer, making brute force redundant.

Community Discussion (14 comments)

przemyslaw1 👍 11 Selected: B

B. Exploit the NetBIOS SNMP uses UDP ports 161 and 162

agelbahri 👍 1 Selected: B

CEH v12 page : 411 NetBIOS is considered first for enumeration because it extracts a large amount of sensitive information about the target network, such as users and network shares.

noyon2002 👍 1

A Brute force active directory, it is the 3rd step in techniques for enumeration : CEH V12 Module 4 Page 403

49f4430 👍 1 Selected: A

A Nothing about 161 and 162, B is a attack..that leave us with A :validate the usernames

pranav10 👍 1 Selected: C

CEHv12 page number 404

jrbobson 👍 1 Selected: C

Enumeration is the key - C

Rafael_Fontana 👍 1 Selected: B

You already have usernames so.... Am I missing something?

duke_of_kamulu 👍 2

GUYS AGAIN i repeat answers is C go to page 403,404 and check you will find its clear the steps they are six

Spam_Protection 👍 1 Selected: A

You need to validate your usernames. You can do this brute forcing Active Directory. Module 4: Techniques for Enumeration section - ▪ Brute force Active Directory Microsoft Active Directory is susceptible to username enumeration at the time of user-supplied input verification. This is a design error in the Microsoft Active Directory implementation. If a user enables the “logon hours” feature, then all the attempts at service authentication result in different error messages. Attackers take advantage of this to enumerate valid usernames. An attacker who succeeds in extracting valid usernames can conduct a brute-force attack to crack the respective passwords.

sosindi 👍 2

A, We already extracted emails usernames- "successfully obtained a list of usernames using email IDs and execute a DNS Zone Transfer" the next would be A now to exploit netbios.

duke_of_kamulu 👍 1

according to CEHv12 they follow systematic flow shown clearly on the table pg 403 1-6 so C get Techniques for Enumeration step six last step is Extract usernames using SNMP

JustAName 👍 1 Selected: C

I'd choose C because exploitation and brute force attacks are typically considered post-enumeration activities and consider too invasive to be "enumeration" activity

insaniunt 👍 3 Selected: C

just pay attention, the question asking for "Which enumeration technique", not about perform attack or exploit something

cloudgangster 👍 3 Selected: C

c, check ceh v12 pg 403

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option B is the correct choice because port 139 indicates the NetBIOS Session Service is active. In the CEH methodology, NetBIOS enumeration is a primary step after identifying open ports, as it allows the extraction of a large amount of sensitive information including user lists, machine names, and shared resources without necessarily launching an attack immediately.

Why the Other Options Are Wrong

Option A is incorrect because the scenario states that usernames have already been successfully obtained via email IDs and DNS Zone Transfer; therefore, brute-forcing AD for usernames is redundant. Option C is wrong because SNMP typically runs on UDP ports 161/162, not TCP 139 or 25. Option D is invalid because NFS uses port 2049, which was not identified as open in the scenario.

Community Comment Notes

Community discussion highlights a conflict between "exploit" and "enumerate." As insaniunt noted, "the question asking for 'Which enumeration technique', not about perform attack or exploit something," suggesting that extracting data via NetBIOS fits the definition better than a full breach. Others like duke_of_kamulu reference CEH v12 page 403-404, emphasizing the systematic flow where NetBIOS enumeration precedes other steps when specific ports are identified.

Exam Strategy

Always cross-reference identified ports with their standard services before selecting an option. If the question asks for enumeration, prioritize techniques that gather information (like NetBIOS queries) over those that directly compromise access, unless the service itself is the target for immediate exploitation.

Frequently Asked Questions

Why is brute force (A) incorrect if usernames are known?

Since the scenario states usernames were already obtained via DNS Zone Transfer, brute-forcing AD is redundant. The next logical step is to use the known service (NetBIOS) to gather more details.

Does NetBIOS enumeration count as an attack?

In the context of this exam question, leveraging NetBIOS to extract shares and users is classified as an enumeration technique aimed at gathering intelligence rather than a destructive exploit.

More 312-50v12 FAQ →

Related Analysis

← Back to 312-50v12 Study Guide